During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to execute commands by manipulating the input.
My starting point is the following, which will output the help for
printf '*filter\n--help\n' | iptables-restore --test
So I know that options are executed as expected. Now, the man page mentions a
--modprobe=command option, which is described as:
When adding or inserting rules into a chain, use command to load any necessary modules (targets, match extensions, etc).
Great, I thought, I can execute a command by providing a non-existent target and coaxing iptables into probing for it. I've tried the following (and variants thereof):
printf '*filter\n--modprobe=/some/command -A INPUT -j sometarget\n' | iptables-restore --test
But this just gives an error without attempting to execute
iptables-restore v1.4.12: Couldn't load target `sometarget':No such file or directory
I've also tried using a module which exists but isn't currently loaded, but the module gets loaded successfully without calling the custom modprobe command.
Any hints or suggestions on where to go next (or any other routes I could investigate) would be greatly appreciated!
--modprobe seems to be out of the question, so the question becomes: are there any other potential exploits possible by passing malicious rules to